react-shopwave-connect 0.1.1 → 0.2.0

package/dist/next/index.cjs

@@ -0,0 +1,585 @@
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+let next_headers = require("next/headers");
+next_headers = __toESM(next_headers);
+let next_server = require("next/server");
+next_server = __toESM(next_server);
+let iron_session = require("iron-session");
+iron_session = __toESM(iron_session);
+
+//#region src/server/errors.ts
+var ShopwaveAuthError = class extends Error {
+	code;
+	status;
+	/** Raw response body from the auth server, if any. Never contains our secret. */
+	body;
+	constructor(code, message, details = {}) {
+		super(message, details.cause !== void 0 ? { cause: details.cause } : void 0);
+		this.name = "ShopwaveAuthError";
+		this.code = code;
+		this.status = details.status;
+		this.body = details.body;
+	}
+	/**
+	* True when the auth server rejected the grant itself (bad/expired code or
+	* refresh token) rather than failing for a transient reason. Callers should
+	* treat the user as logged out.
+	*/
+	get isInvalidGrant() {
+		return (this.code === "token_exchange_failed" || this.code === "token_refresh_failed") && this.status !== void 0 && this.status >= 400 && this.status < 500;
+	}
+};
+
+//#endregion
+//#region src/server/token.ts
+/** Shopwave API error id meaning "access token expired / invalid". */
+const SHOPWAVE_TOKEN_EXPIRED_ERROR_ID = 908;
+/**
+* Converts a token-endpoint response into a {@link ShopwaveToken}.
+* Returns `null` when the response has no access token.
+*
+* @param previous  the token being refreshed; its refresh token is kept when
+*                  the server doesn't send a new one.
+*/
+function tokenFromResponse(response, previous, now = Date.now()) {
+	if (!response || typeof response.access_token !== "string" || !response.access_token) return null;
+	const expiresIn = Number(response.expires_in);
+	return {
+		accessToken: response.access_token,
+		refreshToken: typeof response.refresh_token === "string" && response.refresh_token || previous?.refreshToken,
+		tokenType: typeof response.token_type === "string" && response.token_type || "OAuth",
+		expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? now + expiresIn * 1e3 : void 0
+	};
+}
+/**
+* Reads a token from session storage. Accepts both the current shape and the
+* legacy raw response that older apps (e.g. AdminUI ≤ 0.1) stored directly in
+* the session, so existing sessions survive an upgrade.
+*/
+function normalizeStoredToken(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const t = raw;
+	if (typeof t.accessToken === "string" && t.accessToken) return {
+		accessToken: t.accessToken,
+		refreshToken: typeof t.refreshToken === "string" ? t.refreshToken : void 0,
+		tokenType: typeof t.tokenType === "string" && t.tokenType ? t.tokenType : "OAuth",
+		expiresAt: typeof t.expiresAt === "number" ? t.expiresAt : void 0
+	};
+	if (typeof t.access_token === "string" && t.access_token) return {
+		accessToken: t.access_token,
+		refreshToken: typeof t.refresh_token === "string" ? t.refresh_token : void 0,
+		tokenType: typeof t.token_type === "string" && t.token_type ? t.token_type : "OAuth"
+	};
+	return null;
+}
+/**
+* True when the token has passed its expiry (minus `skewSeconds`).
+* Tokens without a known expiry are treated as valid.
+*
+* Shopwave only issues a new access token once the old one has actually
+* expired, so the default skew is 0 — refreshing early just returns the same
+* token.
+*/
+function isTokenExpired(token, { skewSeconds = 0, now = Date.now() } = {}) {
+	if (token.expiresAt === void 0) return false;
+	return now >= token.expiresAt - skewSeconds * 1e3;
+}
+/** `Authorization` header value, e.g. `OAuth 111ad…`. */
+function authorizationHeader(token) {
+	return `${token.tokenType || "OAuth"} ${token.accessToken}`;
+}
+/**
+* True when a Shopwave API response means "your access token is no longer
+* valid": HTTP 401, or the API error 908 in the response envelope.
+* Use it to trigger a forced refresh + a single retry.
+*/
+function isExpiredTokenResponse(status, body) {
+	if (status === 401) return true;
+	const errors = body?.api?.message?.errors;
+	if (!errors || typeof errors !== "object") return false;
+	return Object.entries(errors).some(([key, value]) => key === String(SHOPWAVE_TOKEN_EXPIRED_ERROR_ID) || Number(value?.id) === SHOPWAVE_TOKEN_EXPIRED_ERROR_ID);
+}
+
+//#endregion
+//#region src/server/oauth.ts
+const REQUIRED_KEYS = [
+	"authServerUrl",
+	"clientId",
+	"clientSecret",
+	"redirectUri"
+];
+/** Throws a readable error when required settings are missing. */
+function assertOAuthConfig(config) {
+	const missing = REQUIRED_KEYS.filter((k) => !config?.[k]);
+	if (missing.length > 0) throw new ShopwaveAuthError("config_invalid", `Shopwave auth is missing required settings: ${missing.join(", ")}`);
+}
+function trimSlash(url) {
+	return url.replace(/\/+$/, "");
+}
+/**
+* Creates a framework-agnostic Shopwave OAuth client (authorization-code flow
+* with a client secret — the Shopwave auth server does not support PKCE, so
+* this must run on a server).
+*
+* Config is validated lazily on first use, so creating the client at module
+* scope doesn't break builds where env vars aren't present.
+*/
+function createShopwaveOAuth(config) {
+	const endpoints = {
+		login: config.endpoints?.login ?? "/login",
+		token: config.endpoints?.token ?? "/oauth/token",
+		logout: config.endpoints?.logout ?? "/logout"
+	};
+	const base = () => {
+		assertOAuthConfig(config);
+		return trimSlash(config.authServerUrl);
+	};
+	const commonParams = (redirectUri) => new URLSearchParams({
+		access_type: config.accessType ?? "online",
+		redirect_uri: redirectUri,
+		response_type: "code",
+		client_id: config.clientId,
+		scope: config.scope ?? "application"
+	});
+	async function postToken(fields, errorCode) {
+		const url = `${base()}${endpoints.token}`;
+		const doFetch = config.fetch ?? globalThis.fetch;
+		let body;
+		if (config.tokenRequestFormat === "multipart") {
+			const fd = new FormData();
+			for (const [k, v] of Object.entries(fields)) fd.append(k, v);
+			body = fd;
+		} else body = new URLSearchParams(fields);
+		let response;
+		try {
+			response = await doFetch(url, {
+				method: "POST",
+				body,
+				headers: { Accept: "application/json" },
+				cache: "no-store"
+			});
+		} catch (cause) {
+			throw new ShopwaveAuthError("network_error", `Could not reach the Shopwave auth server`, { cause });
+		}
+		const text = await response.text();
+		if (!response.ok) throw new ShopwaveAuthError(errorCode, `Shopwave auth server returned ${response.status} for ${fields.grant_type}`, {
+			status: response.status,
+			body: text.slice(0, 2e3)
+		});
+		try {
+			return JSON.parse(text);
+		} catch (cause) {
+			throw new ShopwaveAuthError("token_response_invalid", "Token response was not JSON", {
+				status: response.status,
+				body: text.slice(0, 2e3),
+				cause
+			});
+		}
+	}
+	return {
+		config,
+		buildLoginUrl({ state } = {}) {
+			const params = commonParams(config.redirectUri);
+			if (state) params.set("state", state);
+			return `${base()}${endpoints.login}?${params.toString()}`;
+		},
+		buildLogoutUrl({ redirectUri } = {}) {
+			const params = commonParams(redirectUri ?? config.postLogoutRedirectUri ?? config.redirectUri);
+			return `${base()}${endpoints.logout}?${params.toString()}`;
+		},
+		async exchangeCode(code) {
+			if (!code) throw new ShopwaveAuthError("token_exchange_failed", "Missing authorization code");
+			const token = tokenFromResponse(await postToken({
+				code,
+				redirect_uri: config.redirectUri,
+				client_id: config.clientId,
+				client_secret: config.clientSecret,
+				scope: config.scope ?? "application",
+				grant_type: "authorization_code"
+			}, "token_exchange_failed"));
+			if (!token) throw new ShopwaveAuthError("token_response_invalid", "Token response had no access_token");
+			return token;
+		},
+		async refreshToken(tokenOrRefreshToken) {
+			const previous = typeof tokenOrRefreshToken === "string" ? {
+				accessToken: "",
+				refreshToken: tokenOrRefreshToken,
+				tokenType: "OAuth"
+			} : tokenOrRefreshToken;
+			if (!previous.refreshToken) throw new ShopwaveAuthError("token_refresh_failed", "No refresh token available", { status: 400 });
+			const token = tokenFromResponse(await postToken({
+				refresh_token: previous.refreshToken,
+				redirect_uri: config.redirectUri,
+				client_id: config.clientId,
+				client_secret: config.clientSecret,
+				grant_type: "refresh_token"
+			}, "token_refresh_failed"), previous);
+			if (!token) throw new ShopwaveAuthError("token_response_invalid", "Refresh response had no access_token");
+			return token;
+		}
+	};
+}
+
+//#endregion
+//#region src/server/returnTo.ts
+/**
+* Helpers for the round trip through the auth server.
+*/
+/**
+* Only allows same-origin relative paths ("/products?tab=1"). Anything that
+* could send the user to another site after login — absolute URLs,
+* protocol-relative "//evil.com", backslash tricks, control characters —
+* falls back to `fallback`.
+*/
+function sanitizeReturnTo(value, fallback = "/") {
+	if (typeof value !== "string" || value.length === 0 || value.length > 2048) return fallback;
+	if (!/^\/(?![/\\])/.test(value)) return fallback;
+	if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+	if (value.includes("\\")) return fallback;
+	return value;
+}
+/** Random, URL-safe value for the OAuth `state` parameter (128 bits, hex). */
+function createState() {
+	const bytes = new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** Constant-time string comparison for state values. */
+function safeEqual(a, b) {
+	if (typeof a !== "string" || typeof b !== "string" || a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+
+//#endregion
+//#region src/next/index.ts
+function normalizePath(p) {
+	const withSlash = p.startsWith("/") ? p : `/${p}`;
+	return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+function pathMatches(pathname, list) {
+	return list.some((raw) => {
+		const p = normalizePath(raw);
+		if (p === "/") return pathname === "/";
+		return pathname === p || pathname.startsWith(`${p}/`);
+	});
+}
+function escapeHtml(s) {
+	return s.replace(/[&<>"']/g, (c) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[c]);
+}
+function readCookie(request, name) {
+	const fromNext = request.cookies?.get?.(name)?.value;
+	if (fromNext) return fromNext;
+	const header = request.headers.get("cookie");
+	if (!header) return void 0;
+	for (const part of header.split(";")) {
+		const idx = part.indexOf("=");
+		if (idx === -1) continue;
+		if (part.slice(0, idx).trim() === name) {
+			const value = part.slice(idx + 1).trim();
+			try {
+				return decodeURIComponent(value);
+			} catch {
+				return value;
+			}
+		}
+	}
+}
+let warnedAboutReadOnlyCookies = false;
+/**
+* Creates the Shopwave auth instance for one Next.js app. Call once at module
+* scope (e.g. `lib/auth.ts`) and reuse. Config is validated on first use, so
+* a missing env var doesn't fail `next build`.
+*/
+function createShopwaveAuth(config) {
+	if (typeof window !== "undefined") throw new Error("react-shopwave-connect/next is server-only. Import it from route handlers, server code or proxy.ts.");
+	const oauth = createShopwaveOAuth(config);
+	const authPath = normalizePath(config.authPath ?? "/auth");
+	const logoutPath = normalizePath(config.logoutPath ?? `${authPath}/logout`);
+	const sessionPath = normalizePath(config.sessionPath ?? "/api/session");
+	const defaultReturnTo = sanitizeReturnTo(config.defaultReturnTo, "/");
+	const requireState = config.requireState ?? true;
+	const skewSeconds = config.refreshSkewSeconds ?? 0;
+	const loginTimeoutMs = (config.loginTimeoutSeconds ?? 600) * 1e3;
+	const cookieName = config.session?.cookieName ?? "shopwave_session";
+	/**
+	* Refresh de-duplication, per server instance. Requests that read the same
+	* (old) token share one refresh while it's in flight, and for a short while
+	* afterwards reuse its result instead of refreshing again.
+	*/
+	const inflightRefresh = /* @__PURE__ */ new Map();
+	const recentRefresh = /* @__PURE__ */ new Map();
+	const RECENT_REFRESH_MS = 3e4;
+	function sessionOptions() {
+		const password = config.session?.password;
+		const passwords = typeof password === "string" ? [password] : Object.values(password ?? {});
+		if (passwords.length === 0 || passwords.some((p) => typeof p !== "string" || p.length < 32)) throw new ShopwaveAuthError("config_invalid", "Shopwave auth: session.password must be at least 32 characters (set a long random secret in your env).");
+		const cookieOptions = {
+			httpOnly: true,
+			secure: config.session.secure ?? process.env.NODE_ENV === "production",
+			sameSite: config.session.sameSite ?? "lax",
+			path: "/"
+		};
+		if (config.session.domain) cookieOptions.domain = config.session.domain;
+		const options = {
+			cookieName,
+			password,
+			cookieOptions
+		};
+		if (typeof config.session.ttl === "number") options.ttl = config.session.ttl;
+		return options;
+	}
+	async function getSession() {
+		return (0, iron_session.getIronSession)(await (0, next_headers.cookies)(), sessionOptions());
+	}
+	/**
+	* Cookies can only be written from route handlers, server actions and proxy.
+	* From a Server Component the token is still usable for this request; it will
+	* simply be refreshed again next time.
+	*/
+	async function trySave(session) {
+		try {
+			await session.save();
+		} catch (error) {
+			if (!warnedAboutReadOnlyCookies) {
+				warnedAboutReadOnlyCookies = true;
+				console.warn("[react-shopwave-connect] Could not update the session cookie (called outside a route handler / server action?).", error?.message);
+			}
+		}
+	}
+	function tryDestroy(session) {
+		try {
+			session.destroy();
+		} catch {}
+	}
+	function refreshOnce(token) {
+		const key = `${token.refreshToken}\u0000${token.accessToken}`;
+		const now = Date.now();
+		const recent = recentRefresh.get(key);
+		if (recent && now - recent.at < RECENT_REFRESH_MS) return Promise.resolve(recent.token);
+		let pending = inflightRefresh.get(key);
+		if (!pending) {
+			pending = oauth.refreshToken(token).then((fresh) => {
+				for (const [k, v] of recentRefresh) if (now - v.at >= RECENT_REFRESH_MS) recentRefresh.delete(k);
+				recentRefresh.set(key, {
+					token: fresh,
+					at: Date.now()
+				});
+				return fresh;
+			}).finally(() => inflightRefresh.delete(key));
+			inflightRefresh.set(key, pending);
+		}
+		return pending;
+	}
+	async function getToken({ forceRefresh = false } = {}) {
+		const session = await getSession();
+		const token = normalizeStoredToken(session.token);
+		if (!token) return null;
+		const expired = isTokenExpired(token, { skewSeconds });
+		if (!forceRefresh && !expired) return token;
+		if (!token.refreshToken) {
+			if (expired || forceRefresh) {
+				tryDestroy(session);
+				return null;
+			}
+			return token;
+		}
+		try {
+			const refreshed = await refreshOnce(token);
+			session.token = refreshed;
+			await trySave(session);
+			return refreshed;
+		} catch (error) {
+			if (error instanceof ShopwaveAuthError && error.isInvalidGrant) {
+				tryDestroy(session);
+				return null;
+			}
+			throw error;
+		}
+	}
+	function loginPath(returnTo) {
+		if (!returnTo) return authPath;
+		const safe = sanitizeReturnTo(returnTo, defaultReturnTo);
+		return `${authPath}?returnTo=${encodeURIComponent(safe)}`;
+	}
+	function redirectTo(location, request) {
+		return next_server.NextResponse.redirect(new URL(location, request.url), 302);
+	}
+	function errorPage(status, message, retryHref) {
+		return new next_server.NextResponse(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in problem</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 1rem;line-height:1.5"><h1 style="font-size:1.25rem">Sign-in didn’t complete</h1><p>${escapeHtml(message)}</p><p><a href="${escapeHtml(retryHref)}">Try again</a></p></body></html>`, {
+			status,
+			headers: {
+				"Content-Type": "text/html; charset=utf-8",
+				"Cache-Control": "no-store"
+			}
+		});
+	}
+	async function authHandler(request) {
+		const url = new URL(request.url);
+		const session = await getSession();
+		const pending = session.pendingLogin;
+		const oauthError = url.searchParams.get("error");
+		if (oauthError) {
+			delete session.pendingLogin;
+			await trySave(session);
+			return errorPage(400, `Shopwave sign-in reported: ${url.searchParams.get("error_description") || oauthError}.`, loginPath(pending?.returnTo));
+		}
+		const code = url.searchParams.get("code");
+		if (!code) {
+			const returnTo$1 = sanitizeReturnTo(url.searchParams.get("returnTo"), defaultReturnTo);
+			const state = createState();
+			session.pendingLogin = {
+				state,
+				returnTo: returnTo$1,
+				createdAt: Date.now()
+			};
+			await session.save();
+			return next_server.NextResponse.redirect(oauth.buildLoginUrl({ state }), 302);
+		}
+		const returnedState = url.searchParams.get("state");
+		const isFresh = !!pending && Date.now() - pending.createdAt <= loginTimeoutMs;
+		const stateMatches = !!pending && !!returnedState && safeEqual(returnedState, pending.state);
+		if (requireState ? !(stateMatches && isFresh) : !!pending && !!returnedState && !stateMatches) {
+			delete session.pendingLogin;
+			await trySave(session);
+			return errorPage(400, "This sign-in link has expired or didn’t start from this browser. Please sign in again.", loginPath(pending?.returnTo));
+		}
+		let token;
+		try {
+			token = await oauth.exchangeCode(code);
+		} catch (error) {
+			console.error("[react-shopwave-connect] Code exchange failed:", error?.message);
+			delete session.pendingLogin;
+			await trySave(session);
+			return errorPage(error instanceof ShopwaveAuthError && error.isInvalidGrant ? 400 : 502, "We couldn’t complete sign-in with Shopwave.", loginPath(pending?.returnTo));
+		}
+		const returnTo = pending?.returnTo ?? defaultReturnTo;
+		delete session.pendingLogin;
+		session.token = token;
+		await session.save();
+		return redirectTo(returnTo, request);
+	}
+	async function logoutHandler(_request) {
+		(await getSession()).destroy();
+		return next_server.NextResponse.redirect(oauth.buildLogoutUrl(), 302);
+	}
+	async function getStatus() {
+		const token = normalizeStoredToken((await getSession()).token);
+		if (!token) return { loggedIn: false };
+		return !isTokenExpired(token) || !!token.refreshToken ? {
+			loggedIn: true,
+			expiresAt: token.expiresAt
+		} : { loggedIn: false };
+	}
+	async function isAuthenticated(request) {
+		const value = readCookie(request, cookieName);
+		if (!value) return false;
+		try {
+			const { password, ttl } = sessionOptions();
+			const token = normalizeStoredToken((await (0, iron_session.unsealData)(value, {
+				password,
+				ttl
+			}))?.token);
+			return !!token && (!isTokenExpired(token) || !!token.refreshToken);
+		} catch {
+			return false;
+		}
+	}
+	const noStore = { "Cache-Control": "no-store" };
+	return {
+		oauth,
+		logoutPath,
+		loginPath,
+		getSession,
+		getStatus,
+		getToken,
+		async getAccessToken(options) {
+			return (await getToken(options))?.accessToken ?? null;
+		},
+		async getAuthorizationHeader(options) {
+			const token = await getToken(options);
+			return token ? authorizationHeader(token) : null;
+		},
+		withAuth(handler) {
+			return async (request, context) => {
+				const token = await getToken();
+				if (!token) return next_server.NextResponse.json({ error: "unauthorized" }, {
+					status: 401,
+					headers: noStore
+				});
+				return handler(request, context, {
+					accessToken: token.accessToken,
+					authorization: authorizationHeader(token),
+					token
+				});
+			};
+		},
+		isAuthenticated,
+		async protect(request, options = {}) {
+			const { pathname, search } = new URL(request.url);
+			if (pathMatches(pathname, [
+				authPath,
+				logoutPath,
+				sessionPath,
+				...options.publicPaths ?? []
+			])) return;
+			if (await isAuthenticated(request)) return void 0;
+			if (pathMatches(pathname, options.apiPaths ?? ["/api"])) return next_server.NextResponse.json({ error: "unauthorized" }, {
+				status: 401,
+				headers: noStore
+			});
+			return redirectTo(loginPath(pathname + search), request);
+		},
+		handlers: {
+			auth: authHandler,
+			logout: logoutHandler,
+			session: {
+				async GET() {
+					return next_server.NextResponse.json(await getStatus(), { headers: noStore });
+				},
+				async DELETE() {
+					(await getSession()).destroy();
+					return new next_server.NextResponse(null, {
+						status: 204,
+						headers: noStore
+					});
+				}
+			}
+		}
+	};
+}
+
+//#endregion
+exports.ShopwaveAuthError = ShopwaveAuthError;
+exports.authorizationHeader = authorizationHeader;
+exports.createShopwaveAuth = createShopwaveAuth;
+exports.isExpiredTokenResponse = isExpiredTokenResponse;
+//# sourceMappingURL=index.cjs.map